Finding this should have been trivial for MS. And further, why would you only have one mechanism for tenancy enforcement? Networking is a fine boundary, but there should have been a token as well.
Honestly, this bug, and this comment on the recent ChaosDB bug, https://news.ycombinator.com/item?id=29296170, make me think that Azure just doesn't know how to do tenant segregation securely. These types of bugs where some small flaw allow complete takeover of other accounts (or worse, complete takeover of the whole service) are pretty catastrophic.
Totally broken features are regularly shipped and stay broken.
A random example: Application Gateway shows 5 metrics if you open one in the Portal on the first page. Two of those metrics aggregate a rate (Mbps) using sum instead of avg.
40% of their front-and-center graphs show gibberish, and that’s been like that for probably years.
No one tested any of this. Not a security person, not a UX person, or any manager.
PS: Take a look at the cypher suites offered by App Gateway and its and TLS defaults. Note the current year. Now consider that this is their security product with Web Application Firewall functionality!
Would you trust their WAF to keep you safe? Or just tick a checkbox that some auditor says needs ticking?
That took almost no time or effort to realize.